fix(vpn): disable vpn-egress — network blackholes PIA IPs (not ports/MTU/cluster)

Decisive diagnosis: OpenVPN's outbound init packets are 14 bytes with zero
replies (so MTU was never the blocker), pod UDP egress is healthy (NTP replies),
but TCP 501/443 to PIA IPs time out while Google/Cloudflare are OPEN — across many
PIA servers. This 192.168.2.x WiFi segment blackholes PIA's IP ranges (and
intercepts DNS). Not code-fixable. Reverted the port/MTU red-herring env to PIA
defaults; disabled vpn-egress pending an operator network fix (move to the
unfiltered 192.168.1.x LAN, or unblock PIA on the router). Full trace in
DECISIONS-LOG.

Co-Authored-By: Claude Opus 4.8 <[email protected]>

clusters/base/cluster-vars.yaml

@@ -43,10 +43,8 @@ data:
                                              # which lacks PF; NOT a US region, which also lack PF)
   CLUSTER_POD_CIDR: "10.0.0.0/8"             # Cilium cluster-pool pod CIDR (pods get 10.x); Gluetun
                                              # FIREWALL_OUTBOUND_SUBNETS = allow these to egress via the tunnel
-  # NOTE: PIA OpenVPN port is HARDCODED "8080" in gluetun-gateway.yaml, not a cluster-var — Flux/kustomize
-  # strips quotes around a bare "${VAR}" so a numeric value coerces to int, which k8s rejects for an env
-  # value (same gotcha as the Longhorn numberOfReplicas fix). 8080 chosen: 1197 conflicts with the home
-  # OpenVPN server, 53 is DNS-intercepted here; both confirmed by tcpdump. See DECISIONS-LOG.
+  # NOTE: Phase-3 VPN (vpn-egress) is DISABLED — the network blackholes traffic to PIA's IP ranges
+  # (operator fix needed, not a config issue). Uses PIA's default OpenVPN UDP port. See DECISIONS-LOG.
 
   # --- identity / auth (ADR-0014) ---
   KEYCLOAK_REPLICAS: "1"                     # dev 1 | prod 2 (HA)